PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove deprecated tagSocket() permissions

Browse Source 
tagSocket() now results in netd performing these actions on behalf
of the calling process.

Remove direct access to:
/dev/xt_qtaguid
/proc/net/xt_qtaguid/ctrl

Bug: 68774956
Test: -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.AppSecurityTests
    -m CtsNativeNetTestCases
Test: stream youtube, browse chrome
Test: go/manual-ab-ota
Change-Id: I6a044f304c3ec4e7c6043aebeb1ae63c9c5a0beb
This commit is contained in:
Jeff Vander Stoep 2018-04-02 14:17:59 -07:00 committed by Jeffrey Vander Stoep
parent f22c062c16
commit 0d1e52a50f
3 changed files with 0 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
private/system_server.te
View File

@ -122,10 +122,6 @@ allow system_server hal_audio_server:file w_file_perms;
# for dumping stack traces of native processes.
r_dir_file(system_server, domain)
# Read/Write to /proc/net/xt_qtaguid/ctrl and and /dev/xt_qtaguid.
allow system_server qtaguid_proc:file rw_file_perms;
allow system_server qtaguid_device:chr_file rw_file_perms;
# Write /proc/uid_cputime/remove_uid_range.
allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };

4
public/mediaserver.te
View File

@ -60,10 +60,6 @@ r_dir_file(mediaserver, media_rw_data_file)
# Grant access to read files on appfuse.
allow mediaserver app_fuse_file:file { read getattr };
# Read/[write] to /proc/net/xt_qtaguid/ctrl and /dev/xt_qtaguid
allow mediaserver qtaguid_proc:file rw_file_perms;
allow mediaserver qtaguid_device:chr_file r_file_perms;
# Needed on some devices for playing DRM protected content,
# but seems expected and appropriate for all devices.
unix_socket_connect(mediaserver, drmserver, drmserver)

5
public/update_engine.te
View File

@ -4,11 +4,6 @@ type update_engine_exec, exec_type, file_type;
net_domain(update_engine);
# Read/[write] to /proc/net/xt_qtaguid/ctrl and /dev/xt_qtaguid to tag network
# sockets.
allow update_engine qtaguid_proc:file rw_file_perms;
allow update_engine qtaguid_device:chr_file r_file_perms;
# Following permissions are needed for update_engine.
allow update_engine self:process { setsched };
allow update_engine self:global_capability_class_set { fowner sys_admin };